The need to guarantee that one is dealing with the unique copy of a good is well established. Consider, for example, the case of banknotes. Ever since banknotes have been invented, banks and governments have been fighting duplicators and counterfeiters. A counterfeit, the so-called Superdollar, achieved notoriety as the United States alleged that it was made by a foreign government. It has become easy to produce passable counterfeits using digital technology; $5 bills have been converted to $100 bills using ordinary HP printers, and the fraud has been recently detected only because it went on for two years and involved hundreds of counterfeits.
In the hope of mitigating the problem of forgeries, many security measures have been taken: special (e.g., embossed) paper, watermarkings, special inks, etc. Redesigned $20, $50, $10, and $5 bills were introduced between 2003 and 2008. A new $100 bill—the most commonly counterfeited bill, according to the United States Secret Service—entered circulation last year. It includes two new security features: a blue 3-D security ribbon and a color-changing bell in an inkwell. No security measure so far, however, has proved to be foolproof, and new measures have to be continually invented.
Quantum mechanics has been recently relied upon to generate unforgeable money. These schemes are very interesting, but not yet practical, and certainly difficult to analyze. The problem is exacerbated by an additional constraint: namely, its solution must not only be feasible, but also cheap. Indeed, an unforgeable $100-banknote that costs—say—$10 to mass produce would not be too useful.
Accordingly, it is desirable to provide an approach to unforgeable money (and more generally to authenticate goods and information about goods) that is practical, secure, and inexpensive.